System Configuration Utility

[Guest]

Under the start up tab in the System Configuration Utility I have a Start Up
item that is in Japanese letters. I do not know where it came from. Is it
possible that it came from a virus, I just got rid of 2, or is it just from a
downloaded game or software.
How can I tell where it came from and how can I get rid of it.

Thank you.

 

[Wesley Vogel]

msconfig can handle startups from these locations...
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
Load and Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
%allusersprofile%\Start Menu\Programs\Startup
%userprofile%\Start Menu\Programs\Startup

msconfig Startup Item, Command & Location

In the System Configuration Utility (msconfig.exe), items in the column
Startup Item get their names from:

1. The name of the shortcut in
C:\Documents and Settings\All Users\Start Menu\Programs\Startup
or %allusersprofile%\Start Menu\Programs\Startup

2. The name of the shortcut in
C:\Documents and Settings\Your Name Here\Start Menu\Programs\Startup
or %userprofile%\Start Menu\Programs\Startup

3. From the Value Name under the Name column in the registry under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
and
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
and other various startup locations in the registry.

In msconfig, items in the column Command get their names from:

1. The path to the startup item in
C:\Documents and Settings\All Users\Start Menu\Programs\Startup
or %allusersprofile%\Start Menu\Programs\Startup

2. The path to the startup item in
C:\Documents and Settings\Your Name Here\Start Menu\Programs\Startup
or %userprofile%\Start Menu\Programs\Startup

3. The path to the startup item in the Data column in the registry under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
and
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
and other various startup locations in the registry.

In msconfig, Common Startup listed in the Location column, refers to
%allusersprofile%\Start Menu\Programs\Startup

In msconfig, Startup listed in the Location column, refers to
%userprofile%\Start Menu\Programs\Startup

As far as I know anything else listed under the Location column refers to
whatever startup registry key...

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
Load and Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

For any logged on user, Start button\All Programs\Startup contains whatever
is in both
%userprofile%\Start Menu\Programs\Startup
and
%allusersprofile%\Start Menu\Programs\Startup
-----

%userprofile% is an environment variable that is the path to the user's home
folder.

Typing or pasting %userprofile% into the Start | Run box opens to the
Documents
and Settings folder on whatever drive it is located on for the logged in
user.

I.e. C:\Documents and Settings\Your Name Here

%allusersprofile% is an environment variable that is the path to the All
Users folder.

Typing or pasting %allusersprofile% into the Start | Run box opens to the
Documents and Settings\All Users folder on whatever drive it is located on.

I.e. C:\Documents and Settings\All Users


--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Ted Zieglar]

I'll bet a week of my salary that it's a virus or other malware.

 

[Guest]

Would that mean that the virus or malware is still in the system? It is
currently unchecked, what could happen if it was checked?
I have run NAV 2006, which allowed the virus in the first place, and both
Ad-aware and Spybot.

 

[Ted Zieglar]

A virus or malware doesn't care what you have checked or not checked in the
system configuration utility.

It's easy for a virus or malware to get past your 'anti-' software if that
software is not updated or not being used correctly. In the case of
non-virus malware, the endless variety of malicious software is so vast that
no program can protect you from all of it. You, by adopting safe and smart
computing habits, are the first line of defense. Don't blame your programs,
especially when you download games from the internet.

 

[Guest]

I hear you, but unfortunately with 3 kids all using MSN Messenger and playing
online games it's hard. I do keep up to date on NAV and Windows XP and
constantly run the Ad-aware/Spybot programs. I suspect the latest virus came
throught MSN Messenger.

Thanks for the info.

 

[Ted Zieglar]

You're the father.

 

[Ron Martell]

I hear you, but unfortunately with 3 kids all using MSN Messenger and playing
online games it's hard. I do keep up to date on NAV and Windows XP and
constantly run the Ad-aware/Spybot programs. I suspect the latest virus came
throught MSN Messenger.

Thanks for the info.

Try at least one of the following free online scanners:
Trend Micro http://housecall.trendmicro.com
Kaspersky Online Scanner http://www.kaspersky.com/virusscanner
Panda ActiveScan http://www.pandasoftware.com/activescan
WindowSecurity.com TrojanScan http://windowssecurity.com/trojanscan
Webroot http://www.webroot.com/

A occasional "second opinion" from one of these is always a good idea,
especially with the user environment that you have.

Good luck

Ron Martell Duncan B.C. Canada
--
Microsoft MVP (1997 - 2006)
On-Line Help Computer Service
http://onlinehelp.bc.ca

"Anyone who thinks that they are too small to make a difference
has never been in bed with a mosquito."